---
id: "CVE-2026-113808"
kind: "vulnerability"
aliases: ["CVE-2026-113808"]
title: "SNS enrollment Portal: stored XSS via captive portal user creation"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["captive-portal", "other", "sns-enrollment-portal"]
not_affected_if: []
published_at: "2026-10-20T19:17:34+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:34:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113808", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# SNS enrollment Portal: stored XSS via captive portal user creation

The SNS enrollment Portal has a stored cross-site scripting flaw reachable through its captive portal when a user is created. The injected script runs in the browser of an administrator who validates the request, so an attacker can act with admin rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113808

## From the sources

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_